Kubero
Monthly
Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No public exploit code was identified at time of analysis.
Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No public exploit code was identified at time of analysis.